From 4d0aef1c865b7136ffa53541aae0595ca28e89f1 Mon Sep 17 00:00:00 2001
From: randogoth <kflux@posteo.de>
Date: Sun, 1 Feb 2026 20:06:55 +0200
Subject: [PATCH] Enable secure boot via lanzaboote on installer ISO

---
 hosts/installer.nix            |  1 +
 modules/system/secure-boot.nix | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+)
 create mode 100644 modules/system/secure-boot.nix

diff --git a/hosts/installer.nix b/hosts/installer.nix
index edd0a22..54d0d2d 100644
--- a/hosts/installer.nix
+++ b/hosts/installer.nix
@@ -5,6 +5,7 @@
     (inputs.nixpkgs + "/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix")
     inputs.lix-module.nixosModules.lixFromNixpkgs
     ../modules/system/base.nix
+    ../modules/system/secure-boot.nix
     ../modules/users/admin.nix
   ];
 
diff --git a/modules/system/secure-boot.nix b/modules/system/secure-boot.nix
new file mode 100644
index 0000000..18552cf
--- /dev/null
+++ b/modules/system/secure-boot.nix
@@ -0,0 +1,20 @@
+{ lib, ... }:
+
+{
+  # Use Lanzaboote to build signed Unified Kernel Images and shim-compatible boot chain.
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = {
+      name = "nanuqsaurus";
+      description = "Secure Boot keys for nanuqsaurus installer ISO";
+    };
+  };
+
+  # Ensure systemd-boot is not pulled in by other modules.
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+
+  boot.loader.efi = {
+    canTouchEfiVariables = true;
+    efiSysMountPoint = "/boot";
+  };
+}